Linux Kernel EUVD-2026-59396

Exploitation requires: (1) a physical or virtual Linux host with a Broadcom NetXtreme adapter that supports the bnxt_re RDMA driver, (2) the bnxt_re kernel module loaded and RDMA verbs interface accessible (typically /dev/infiniband or similar), (3) the attacker holds local user access with permission to open RDMA verb interfaces - typically membership in the 'rdma' or equivalent group, matching PR:L in the CVSS vector. Non-default access controls (e.g., restrictive udev rules or no rdma-capable hardware) prevent exploitation entirely. Remote unauthenticated exploitation is not possible; AV:L confirms strict local access requirement. The RDMA subsystem is not enabled by default on most general-purpose Linux deployments, substantially narrowing the real-world attack surface compared to the raw CVSS score implies.

The reported CVSS 8.8 score and S:C scope change signal a theoretically serious local privilege escalation pathway, but multiple contextual signals dampen real-world urgency. EPSS at 0.15% (5th percentile) indicates this is not being actively probed or exploited broadly. The CVE is not listed in CISA KEV, and no public exploit or POC is known. Exploitation requires: (1) a system with a Broadcom NetXtreme adapter supporting bnxt_re RDMA, (2) the RDMA subsystem loaded and accessible, and (3) a low-privilege user with access to RDMA verb interfaces - a non-trivial combination outside HPC and data center environments. The CVSS attack vector (AV:L) correctly reflects that this is not remotely triggerable over the network. The C:H/I:H ratings presuppose successful kernel memory corruption, which may require specific kernel heap layout conditions - the actual exploitability to full compromise is uncertain and likely harder than the score implies. This is a real defect requiring patching but represents low immediate operational risk outside targeted environments running Broadcom RDMA hardware.

A local user on a Linux server equipped with a Broadcom NetXtreme RDMA adapter opens a user-space RDMA verbs connection and creates a Send Queue (SQ) with a WQE mode value exceeding 65535 or set to zero. Because no bounds check exists in the bnxt_re driver prior to the fix, the invalid value is passed directly to hardware queue management logic, potentially corrupting kernel data structures or triggering hardware fault handling that allows the attacker to escalate privileges or crash the system. No public exploit code is known at time of analysis, but the attack is straightforward for anyone with RDMA programming knowledge on a vulnerable system.